tm2027-v0[.]2[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
tm2027-v0.2.1.exe
Size 17.0MB
Sample261006-vm2waa1x3j
SHA256 951243678b0d4ff9269bccd1f5775c6764012b99071f31df71b17b4be8dbf50b
MD5 1b93c430bb22e0fca5822abde14f8e7f
SHA1 6899a2cab72defe64e69b7ddb9a0a969efaa505e
SHA512 c5a1184683f1cce1b3b1d5b1d550ac7dc4bb4966fa564594d9c6a0f1d791001f974fa0f9f1e7d526a67d59be7cc5cb882cddf691dd30873a68fb2e103f346a05
SSDEEP 98304:EmrVRymiZQUh+UVOg7Va/B1QbOqsuE6S+pwXJ4C8gTZeKCJI+PS2pCwLkuYz226P:JRyPFOqsujWZR+PTpCJNz2dqSwz9
TLSH
T1CD074B51E69F99ACD05BC8B0C3079A774E2534CB1A26B9BF41C4553C3FAE7E05B2870A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tm2027-v0.2.1.exe

File Explorer

tm2027-v0.2.1.exe

.exe 17.0MB

tm2027-v0.2.1.exe

IMPHASH c17eea98cb7f4fbf4b4abb76a6b8fe46
SHA256 951243678b0d4ff9269bccd1f5775c6764012b99071f31df71b17b4be8dbf50b
MD5 1b93c430bb22e0fca5822abde14f8e7f
SHA1 6899a2cab72defe64e69b7ddb9a0a969efaa505e
SHA512 c5a1184683f1cce1b3b1d5b1d550ac7dc4bb4966fa564594d9c6a0f1d791001f974fa0f9f1e7d526a67d59be7cc5cb882cddf691dd30873a68fb2e103f346a05
SSDEEP 98304:EmrVRymiZQUh+UVOg7Va/B1QbOqsuE6S+pwXJ4C8gTZeKCJI+PS2pCwLkuYz226P:JRyPFOqsujWZR+PTpCJNz2dqSwz9
TLSH
T1CD074B51E69F99ACD05BC8B0C3079A774E2534CB1A26B9BF41C4553C3FAE7E05B2870A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11752468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tm2027.pdb

user32

GetKeyboardLayout GetWindowTextW VkKeyScanW DestroyIcon CreateIconIndirect EnumWindows SetWindowTextW SetForegroundWindow SendInput SetFocus SetActiveWindow IsIconic IsWindowVisible GetCursorPos DispatchMessageW GetMessageW GetClipboardFormatNameW IsClipboardFormatAvailable GetClipboardData EnumClipboardFormats CountClipboardFormats CloseClipboard EmptyClipboard OpenClipboard GetActiveWindow SetWindowPlacement DestroyWindow SetClipboardData PostQuitMessage GetKeyboardLayoutNameW MapVirtualKeyW ToUnicode MonitorFromPoint GetWindowPlacement GetClientRect GetWindowRect KillTimer SetWindowLongPtrW SetTimer GetWindowLongPtrW GetDoubleClickTime GetSystemMetrics ShowWindow EnumDisplayMonitors ShowWindowAsync SetCapture TrackMouseEvent ReleaseCapture IsZoomed GetSystemMetricsForDpi GetDpiForWindow DefWindowProcW SetCursor IsWindowEnabled SetWindowPos TranslateMessage MonitorFromWindow ValidateRect GetKeyState CreateWindowExW GetMonitorInfoW SystemParametersInfoW MessageBoxW RegisterClipboardFormatW RegisterClassW PostMessageW ScreenToClient SendMessageW RedrawWindow LoadImageW

kernel32

InitializeSListHead SetUnhandledExceptionFilter IsDebuggerPresent UnhandledExceptionFilter LCIDToLocaleName LoadLibraryExA IsProcessorFeaturePresent CancelIo FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetExitCodeProcess GetCurrentThreadId GetSystemTimePreciseAsFileTime CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW GetFileAttributesW CreateEventW ReadFile GetOverlappedResult WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode GetStdHandle WriteConsoleW MultiByteToWideChar GetModuleFileNameW GetTempPathW GetFullPathNameW FormatMessageW FindFirstFileExW DeleteFileW GetFileInformationByHandle SetFileTime GetFileInformationByHandleEx GetFinalPathNameByHandleW CreateDirectoryW SetFileInformationByHandle MoveFileExW CopyFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetLastError GetCurrentThread AddVectoredExceptionHandler WaitForSingleObject ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte lstrlenW ConvertFiberToThread DeleteFiber CreateFiber ConvertThreadToFiber IsThreadAFiber SwitchToFiber GetProcessHeap HeapFree HeapReAlloc FindClose CloseHandle GetSystemInfo UnmapViewOfFile GetLastError SwitchToThread QueryPerformanceCounter GetModuleHandleExW QueryPerformanceFrequency GetUserDefaultLocaleName GetModuleHandleA GetProcAddress HeapAlloc GetModuleHandleW GlobalAlloc GlobalLock GlobalUnlock GetSystemTimeAsFileTime GlobalSize CreateThread GetCurrentProcessId LoadLibraryA FreeLibrary LocalFree ReadFileEx SleepEx CreateFileW SetNamedPipeHandleState WriteFileEx CreateNamedPipeW ConnectNamedPipe DisconnectNamedPipe FlushFileBuffers LocalAlloc WaitNamedPipeW VirtualProtect CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle Sleep VirtualQuery SetThreadStackGuarantee

gdi32

CreateSolidBrush DeleteObject CreateBitmap

ole32

CoCreateInstance CoIncrementMTAUsage OleInitialize ReleaseStgMedium RevokeDragDrop RegisterDragDrop CoTaskMemFree CoInitializeEx CoCreateFreeThreadedMarshaler OleUninitialize PropVariantClear

bcryptprimitives

ProcessPrng

advapi32

CredWriteW RegQueryValueExW CredDeleteW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl CredFree CredReadW GetSecurityDescriptorSacl CopySid GetSidLengthRequired GetSidSubAuthorityCount IsValidSid AddAce GetAce InitializeAcl GetAclInformation InitializeSecurityDescriptor FreeSid GetSecurityDescriptorControl SetSecurityDescriptorControl SetSecurityDescriptorGroup GetSecurityDescriptorGroup SetSecurityDescriptorSacl SetSecurityDescriptorOwner GetSecurityDescriptorOwner GetSecurityDescriptorDacl

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

GetErrorInfo SysAllocStringLen SysStringLen SysFreeString SetErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

SHOpenFolderAndSelectItems SHGetDesktopFolder DragQueryFileW ShellExecuteW SHCreateItemFromParsingName SHAppBarMessage

dwmapi

DwmGetCompositionTimingInfo DwmSetWindowAttribute DwmFlush

dwrite

DWriteCreateFactory

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

icuuc

u_strlen

dcomp

DCompositionCreateDevice

ntdll

NtCreateNamedPipeFile NtWriteFile NtOpenFile NtReadFile RtlNtStatusToDosError RtlGetVersion

imm32

ImmGetContext ImmGetCompositionStringW ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetVirtualKey

comctl32

TaskDialogIndirect

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

vcruntime140

memcpy memcmp __current_exception_context __current_exception __C_specific_handler _CxxThrowException memset __CxxFrameHandler3 memmove

api-ms-win-crt-math-l1-1-0

truncf __setusermatherr ceilf fmodf atan2f log2 pow floorf trunc ceil acosf acos round roundf sinf powf tan sin cosf floor cos tanf fmod atan2

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback terminate __p___argc _seh_filter_exe _set_app_type _configure_narrow_argv _exit exit _initterm _initialize_narrow_environment _crt_atexit __p___argv _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode